CVE-2024-9904
Last modified
CVE-2024-9904 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the file /admin/File/pictureUpload. EPSS estimates a 0.60% chance of exploitation in the next 30 days.
Description
A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the file /admin/File/pictureUpload. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| 07fly | 07flycms | >= 1.0.0, <= 1.2.0 |
| 07fly | Customer Relationship Management | >= 1.0.0, <= 1.2.0 |
References
- https://github.com/DeepMountains/Mirage/blob/main/CVE19-2.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.280180Permissions Required, VDB Entry
- https://vuldb.com/?id.280180Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.421686Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-9904?
How severe is CVE-2024-9904?
How do I fix CVE-2024-9904?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-9898The Parallax Image plugin for WordPress is vulnerable to Sto…5.4
- CVE-2024-9899Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2024-9900mudler/localai version v2.21.1 contains a Cross-Site Scripti…6.1
- CVE-2024-9901Rejected reason: ** REJECT ** DO NOT USE THIS CVE ID NUMBER.…
- CVE-2024-9902A flaw was found in Ansible. The ansible-core `user` module …6.3
- CVE-2024-9903A vulnerability classified as critical has been found in 07F…7.2
- CVE-2024-9905A vulnerability, which was classified as critical, has been …8.8
- CVE-2024-9906A vulnerability, which was classified as problematic, was fo…5.4
- CVE-2024-9907A vulnerability classified as problematic was found in QileC…6.3
- CVE-2024-9908A vulnerability, which was classified as critical, was found…8.8
- CVE-2024-9909A vulnerability has been found in D-Link DIR-619L B1 2.06 an…8.8
- CVE-2024-9910A vulnerability was found in D-Link DIR-619L B1 2.06 and cla…8.8
Are you affected by CVE-2024-9904?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST